@lunora/auth 1.0.0-alpha.37 → 1.0.0-alpha.38

package/dist/adapter.mjs

@@ -1,48 +1 @@
-import { createAdapterFactory } from 'better-auth/adapters';
-import { createSqlAuthStore, d1Executor } from './sql-store.mjs';
-
-const asRow = (row) => row;
-const asRowOrNull = (row) => row ?? null;
-const asRows = (rows) => rows;
-const lunoraAuthAdapter = (store) => createAdapterFactory({
-  adapter: () => {
-    return {
-      consumeOne: async ({ model, where }) => asRowOrNull(await store.consumeOne(model, where)),
-      count: async ({ model, where }) => store.count(model, where ?? []),
-      create: async ({ data, model }) => asRow(await store.create(model, data)),
-      delete: async ({ model, where }) => {
-        await store.remove(model, where);
-      },
-      deleteMany: async ({ model, where }) => store.remove(model, where),
-      findMany: async ({ limit, model, offset, sortBy, where }) => asRows(await store.read(model, { limit, offset, sortBy, where: where ?? [] })),
-      findOne: async ({ model, where }) => {
-        const [row] = await store.read(model, { limit: 1, where });
-        return asRowOrNull(row);
-      },
-      incrementOne: async ({ increment, model, set, where }) => asRowOrNull(await store.incrementOne(model, where, increment, set)),
-      update: async ({ model, update, where }) => {
-        const [row] = await store.update(model, where, update);
-        return asRowOrNull(row);
-      },
-      updateMany: async ({ model, update, where }) => {
-        const updated = await store.update(model, where, update);
-        return updated.length;
-      }
-    };
-  },
-  config: {
-    adapterId: "lunora",
-    adapterName: "Lunora Adapter",
-    // Conservative flags so the adapter is store-agnostic: better-auth
-    // serializes dates/booleans/json to primitives (string/number) before a
-    // write and parses them back after a read, so a store — in-memory or
-    // SQL — only ever handles primitives, never schema-aware codecs.
-    supportsBooleans: false,
-    supportsDates: false,
-    supportsJSON: false,
-    supportsNumericIds: false
-  }
-});
-const lunoraD1Adapter = (d1) => lunoraAuthAdapter(createSqlAuthStore(d1Executor(d1)));
-
-export { lunoraAuthAdapter, lunoraD1Adapter };
+import{createAdapterFactory as d}from"better-auth/adapters";import{createSqlAuthStore as c,d1Executor as l}from"./sql-store.mjs";const m=a=>a,o=a=>a??null,u=a=>a,i=a=>d({adapter:()=>({consumeOne:async({model:e,where:t})=>o(await a.consumeOne(e,t)),count:async({model:e,where:t})=>a.count(e,t??[]),create:async({data:e,model:t})=>m(await a.create(t,e)),delete:async({model:e,where:t})=>{await a.remove(e,t)},deleteMany:async({model:e,where:t})=>a.remove(e,t),findMany:async({limit:e,model:t,offset:r,sortBy:n,where:s})=>u(await a.read(t,{limit:e,offset:r,sortBy:n,where:s??[]})),findOne:async({model:e,where:t})=>{const[r]=await a.read(e,{limit:1,where:t});return o(r)},incrementOne:async({increment:e,model:t,set:r,where:n})=>o(await a.incrementOne(t,n,e,r)),update:async({model:e,update:t,where:r})=>{const[n]=await a.update(e,r,t);return o(n)},updateMany:async({model:e,update:t,where:r})=>(await a.update(e,r,t)).length}),config:{adapterId:"lunora",adapterName:"Lunora Adapter",supportsBooleans:!1,supportsDates:!1,supportsJSON:!1,supportsNumericIds:!1}}),y=a=>i(c(l(a)));export{i as lunoraAuthAdapter,y as lunoraD1Adapter};

package/dist/audit.mjs

@@ -1,22 +1,4 @@
-import { redact, standardRules, piiRules } from '@visulima/redact';
-
-const AUTH_AUDIT_TABLE = "__lunora_auth_audit__";
-const AUDIT_REDACT_RULES = [...standardRules, ...piiRules];
-const DEFAULT_READ_LIMIT = 1e3;
-const MAX_READ_LIMIT = 1e4;
-const SQL_NULL = null;
-const text = (value) => {
-  if (typeof value === "string") {
-    return value;
-  }
-  if (typeof value === "number" || typeof value === "bigint" || typeof value === "boolean") {
-    return String(value);
-  }
-  return void 0;
-};
-const ensureAuthAuditTable = async (executor) => {
-  await executor.run(
-    `CREATE TABLE IF NOT EXISTS "${AUTH_AUDIT_TABLE}" (
+import{redact as A,standardRules as _,piiRules as v}from"@visulima/redact";const n="__lunora_auth_audit__",R=[..._,...v],N=1e3,L=1e4,u=null,s=t=>{if(typeof t=="string")return t;if(typeof t=="number"||typeof t=="bigint"||typeof t=="boolean")return String(t)},m=async t=>{await t.run(`CREATE TABLE IF NOT EXISTS "${n}" (
             seq INTEGER PRIMARY KEY AUTOINCREMENT,
             ts REAL NOT NULL,
             event TEXT NOT NULL,
@@ -26,86 +8,4 @@ const ensureAuthAuditTable = async (executor) => {
             ip TEXT,
             user_agent TEXT,
             detail TEXT
-        )`,
-    []
-  );
-};
-const appendAuthAuditEntry = async (executor, entry, options = {}) => {
-  await ensureAuthAuditTable(executor);
-  let detail;
-  if (entry.detail !== void 0) {
-    detail = options.redactDetail === false ? entry.detail : redact(entry.detail, AUDIT_REDACT_RULES);
-  }
-  await executor.run(
-    `INSERT INTO "${AUTH_AUDIT_TABLE}" (ts, event, outcome, actor_id, actor_email, ip, user_agent, detail) VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
-    [
-      entry.ts,
-      entry.event,
-      entry.outcome,
-      entry.actorId ?? SQL_NULL,
-      entry.actorEmail ?? SQL_NULL,
-      entry.ip ?? SQL_NULL,
-      entry.userAgent ?? SQL_NULL,
-      detail === void 0 ? SQL_NULL : JSON.stringify(detail)
-    ]
-  );
-  if (typeof options.retention === "number" && options.retention > 0) {
-    await executor.run(`DELETE FROM "${AUTH_AUDIT_TABLE}" WHERE seq <= (SELECT MAX(seq) - ? FROM "${AUTH_AUDIT_TABLE}")`, [options.retention]);
-  }
-  return { ...entry, detail };
-};
-const readAuthAuditLog = async (executor, options = {}) => {
-  await ensureAuthAuditTable(executor);
-  const limit = Math.max(1, Math.min(options.limit ?? DEFAULT_READ_LIMIT, MAX_READ_LIMIT));
-  const clauses = ["seq > ?"];
-  const parameters = [options.sinceSeq ?? 0];
-  if (options.actorId !== void 0) {
-    clauses.push("actor_id = ?");
-    parameters.push(options.actorId);
-  }
-  if (options.event !== void 0) {
-    clauses.push("event = ?");
-    parameters.push(options.event);
-  }
-  parameters.push(limit);
-  const rows = await executor.all(
-    `SELECT seq, ts, event, outcome, actor_id, actor_email, ip, user_agent, detail FROM "${AUTH_AUDIT_TABLE}" WHERE ${clauses.join(" AND ")} ORDER BY seq DESC LIMIT ?`,
-    parameters
-  );
-  return rows.map((row) => {
-    const base = {
-      event: text(row["event"]) ?? "",
-      outcome: row["outcome"] === "failure" ? "failure" : "success",
-      seq: Number(row["seq"]),
-      ts: Number(row["ts"])
-    };
-    const actorId = text(row["actor_id"]);
-    const actorEmail = text(row["actor_email"]);
-    const ip = text(row["ip"]);
-    const userAgent = text(row["user_agent"]);
-    const detail = text(row["detail"]);
-    if (actorId !== void 0) {
-      base.actorId = actorId;
-    }
-    if (actorEmail !== void 0) {
-      base.actorEmail = actorEmail;
-    }
-    if (ip !== void 0) {
-      base.ip = ip;
-    }
-    if (userAgent !== void 0) {
-      base.userAgent = userAgent;
-    }
-    if (detail !== void 0) {
-      base.detail = JSON.parse(detail);
-    }
-    return base;
-  });
-};
-const createAuthAuditReader = (executor) => {
-  return {
-    read: (options) => readAuthAuditLog(executor, options)
-  };
-};
-
-export { AUTH_AUDIT_TABLE, appendAuthAuditEntry, createAuthAuditReader, ensureAuthAuditTable, readAuthAuditLog };
+        )`,[])},O=async(t,e,r={})=>{await m(t);let i;return e.detail!==void 0&&(i=r.redactDetail===!1?e.detail:A(e.detail,R)),await t.run(`INSERT INTO "${n}" (ts, event, outcome, actor_id, actor_email, ip, user_agent, detail) VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,[e.ts,e.event,e.outcome,e.actorId??u,e.actorEmail??u,e.ip??u,e.userAgent??u,i===void 0?u:JSON.stringify(i)]),typeof r.retention=="number"&&r.retention>0&&await t.run(`DELETE FROM "${n}" WHERE seq <= (SELECT MAX(seq) - ? FROM "${n}")`,[r.retention]),{...e,detail:i}},I=async(t,e={})=>{await m(t);const r=Math.max(1,Math.min(e.limit??N,L)),i=["seq > ?"],d=[e.sinceSeq??0];return e.actorId!==void 0&&(i.push("actor_id = ?"),d.push(e.actorId)),e.event!==void 0&&(i.push("event = ?"),d.push(e.event)),d.push(r),(await t.all(`SELECT seq, ts, event, outcome, actor_id, actor_email, ip, user_agent, detail FROM "${n}" WHERE ${i.join(" AND ")} ORDER BY seq DESC LIMIT ?`,d)).map(a=>{const o={event:s(a.event)??"",outcome:a.outcome==="failure"?"failure":"success",seq:Number(a.seq),ts:Number(a.ts)},E=s(a.actor_id),c=s(a.actor_email),T=s(a.ip),l=s(a.user_agent),p=s(a.detail);return E!==void 0&&(o.actorId=E),c!==void 0&&(o.actorEmail=c),T!==void 0&&(o.ip=T),l!==void 0&&(o.userAgent=l),p!==void 0&&(o.detail=JSON.parse(p)),o})},h=t=>({read:e=>I(t,e)});export{n as AUTH_AUDIT_TABLE,O as appendAuthAuditEntry,h as createAuthAuditReader,m as ensureAuthAuditTable,I as readAuthAuditLog};

package/dist/email-guard.mjs

@@ -1,71 +1 @@
-import { LunoraError } from '@lunora/errors';
-import { isDisposableDomain, setDomains } from '@visulima/disposable-email-domains';
-import { extractDomain, isFreeDomain, setDomains as setDomains$1 } from '@visulima/free-email-domains';
-
-const listFromModule = (module) => {
-  const value = module.default ?? module;
-  return Array.isArray(value) ? value : [];
-};
-let listsPromise;
-const loadEmailDomainLists = async () => {
-  listsPromise ??= (async () => {
-    const [disposable, free] = await Promise.all([import('@visulima/disposable-email-domains/domains'), import('@visulima/free-email-domains/domains')]);
-    setDomains(listFromModule(disposable));
-    setDomains$1(listFromModule(free));
-  })();
-  return listsPromise;
-};
-const toDomainSet = (domains) => domains && domains.length > 0 ? new Set(domains.map((domain) => domain.toLowerCase())) : void 0;
-const classifyEmail = (email, config = {}) => {
-  const domain = extractDomain(email);
-  if (domain === void 0) {
-    return { domain: void 0, emailClass: "business" };
-  }
-  const allowDomains = toDomainSet(config.allowDomains);
-  if (isDisposableDomain(domain, { allowDomains, customDomains: toDomainSet(config.denyDomains) })) {
-    return { domain, emailClass: "disposable" };
-  }
-  if (isFreeDomain(domain, { allowDomains })) {
-    return { domain, emailClass: "free" };
-  }
-  return { domain, emailClass: "business" };
-};
-const verifyMx = async (domain) => {
-  const { checkMxRecords } = await import('@visulima/email-verifier/checks/mx');
-  const result = await checkMxRecords(domain);
-  return result.valid;
-};
-const assertEmailAllowed = async (email, config = {}) => {
-  if (config.requireValidSyntax !== false) {
-    const { validateSyntax } = await import('@visulima/email-verifier/checks/syntax');
-    if (!validateSyntax(email)) {
-      throw new LunoraError("VALIDATION_ERROR", `@lunora/auth: "${email}" is not a valid email address.`);
-    }
-  }
-  await loadEmailDomainLists();
-  const classification = classifyEmail(email, config);
-  if (classification.emailClass === "disposable" && config.blockDisposable !== false) {
-    throw new LunoraError(
-      "EMAIL_DOMAIN_BLOCKED",
-      `@lunora/auth: signups from the disposable/throwaway domain "${classification.domain ?? email}" are not allowed.`
-    );
-  }
-  if (config.mx === true && classification.domain !== void 0 && !await verifyMx(classification.domain)) {
-    throw new LunoraError(
-      "EMAIL_UNDELIVERABLE",
-      `@lunora/auth: the domain "${classification.domain}" publishes no MX records, so mail to it cannot be delivered.`
-    );
-  }
-  return classification;
-};
-const emailGateMiddleware = (options) => async ({ ctx, next }) => {
-  const email = options.email(ctx);
-  if (email === void 0 || email === "") {
-    throw new LunoraError("VALIDATION_ERROR", "@lunora/auth: emailGateMiddleware received no email to check.");
-  }
-  const classification = await assertEmailAllowed(email, options);
-  options.onClassify?.(classification, ctx);
-  return next();
-};
-
-export { assertEmailAllowed, classifyEmail, emailGateMiddleware, loadEmailDomainLists };
+import{LunoraError as e}from"@lunora/errors";import{isDisposableDomain as m,setDomains as d}from"@visulima/disposable-email-domains";import{extractDomain as c,isFreeDomain as w,setDomains as u}from"@visulima/free-email-domains";const t=a=>{const i=a.default??a;return Array.isArray(i)?i:[]};let n;const D=async()=>(n??=(async()=>{const[a,i]=await Promise.all([import("@visulima/disposable-email-domains/domains"),import("@visulima/free-email-domains/domains")]);d(t(a)),u(t(i))})(),n),r=a=>a&&a.length>0?new Set(a.map(i=>i.toLowerCase())):void 0,f=(a,i={})=>{const o=c(a);if(o===void 0)return{domain:void 0,emailClass:"business"};const s=r(i.allowDomains);return m(o,{allowDomains:s,customDomains:r(i.denyDomains)})?{domain:o,emailClass:"disposable"}:w(o,{allowDomains:s})?{domain:o,emailClass:"free"}:{domain:o,emailClass:"business"}},p=async a=>{const{checkMxRecords:i}=await import("@visulima/email-verifier/checks/mx");return(await i(a)).valid},h=async(a,i={})=>{if(i.requireValidSyntax!==!1){const{validateSyntax:s}=await import("@visulima/email-verifier/checks/syntax");if(!s(a))throw new e("VALIDATION_ERROR",`@lunora/auth: "${a}" is not a valid email address.`)}await D();const o=f(a,i);if(o.emailClass==="disposable"&&i.blockDisposable!==!1)throw new e("EMAIL_DOMAIN_BLOCKED",`@lunora/auth: signups from the disposable/throwaway domain "${o.domain??a}" are not allowed.`);if(i.mx===!0&&o.domain!==void 0&&!await p(o.domain))throw new e("EMAIL_UNDELIVERABLE",`@lunora/auth: the domain "${o.domain}" publishes no MX records, so mail to it cannot be delivered.`);return o},b=a=>async({ctx:i,next:o})=>{const s=a.email(i);if(s===void 0||s==="")throw new e("VALIDATION_ERROR","@lunora/auth: emailGateMiddleware received no email to check.");const l=await h(s,a);return a.onClassify?.(l,i),o()};export{h as assertEmailAllowed,f as classifyEmail,b as emailGateMiddleware,D as loadEmailDomainLists};

package/dist/index.d.mts

@@ -1,7 +1,7 @@
 export { lunoraAuthAdapter, lunoraD1Adapter } from "./adapter.mjs";
 import { LunoraError } from '@lunora/errors';
-import { L as LunoraAuth, a as LunoraAuthOptions } from "./packem_shared/create-auth.d-COcIS_KU.mjs";
-export { c as createAuth, r as resolveAuthOptions } from "./packem_shared/create-auth.d-COcIS_KU.mjs";
+import { L as LunoraAuth, a as LunoraAuthOptions } from "./packem_shared/create-auth.d-De6IOirt.mjs";
+export { c as createAuth, r as resolveAuthOptions } from "./packem_shared/create-auth.d-De6IOirt.mjs";
 import { AppendAuthAuditEntry, AppendAuthAuditOptions, AuthAuditEvent } from "./audit.mjs";
 export { AUTH_AUDIT_TABLE, type AuthAuditEntry, type AuthAuditOutcome, type AuthAuditReader, type ReadAuthAuditOptions, appendAuthAuditEntry, createAuthAuditReader, ensureAuthAuditTable, readAuthAuditLog } from "./audit.mjs";
 import { createAuthMiddleware } from 'better-auth/api';

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 export { lunoraAuthAdapter, lunoraD1Adapter } from "./adapter.js";
 import { LunoraError } from '@lunora/errors';
-import { L as LunoraAuth, a as LunoraAuthOptions } from "./packem_shared/create-auth.d-COcIS_KU.js";
-export { c as createAuth, r as resolveAuthOptions } from "./packem_shared/create-auth.d-COcIS_KU.js";
+import { L as LunoraAuth, a as LunoraAuthOptions } from "./packem_shared/create-auth.d-De6IOirt.js";
+export { c as createAuth, r as resolveAuthOptions } from "./packem_shared/create-auth.d-De6IOirt.js";
 import { AppendAuthAuditEntry, AppendAuthAuditOptions, AuthAuditEvent } from "./audit.js";
 export { AUTH_AUDIT_TABLE, type AuthAuditEntry, type AuthAuditOutcome, type AuthAuditReader, type ReadAuthAuditOptions, appendAuthAuditEntry, createAuthAuditReader, ensureAuthAuditTable, readAuthAuditLog } from "./audit.js";
 import { createAuthMiddleware } from 'better-auth/api';

package/dist/index.mjs

@@ -1,16 +1 @@
-export { lunoraAuthAdapter, lunoraD1Adapter } from './adapter.mjs';
-export { LunoraAuthAdminError, createAuthAdmin } from './packem_shared/LunoraAuthAdminError-CReJPMkx.mjs';
-export { AUTH_AUDIT_TABLE, appendAuthAuditEntry, createAuthAuditReader, ensureAuthAuditTable, readAuthAuditLog } from './audit.mjs';
-export { authAuditHook, buildAuditEntry, eventForPath, withAuthAudit } from './packem_shared/authAuditHook-3OJKhpQV.mjs';
-export { createAuth, resolveAuthOptions } from './packem_shared/createAuth-s4i7WhAh.mjs';
-export { emailGateDatabaseHooks, withEmailGate } from './packem_shared/emailGateDatabaseHooks-BGS4uJM9.mjs';
-export { assertEmailAllowed, classifyEmail, emailGateMiddleware, loadEmailDomainLists } from './email-guard.mjs';
-export { DEFAULT_AUTH_BASE_PATH, handleAuthRequest } from './packem_shared/DEFAULT_AUTH_BASE_PATH-DjcUWEQl.mjs';
-export { LunoraAuthHeadersError, withAuthPlugins } from './middleware.mjs';
-export { compileMigrationsSql, ensureMigrated } from './packem_shared/compileMigrationsSql-Dl5N8z5q.mjs';
-export { default as authTables } from './schema.mjs';
-export { sessionPresets, validateSessionPolicy } from './packem_shared/sessionPresets-Dwwd74_J.mjs';
-export { createSqlAuthStore, d1Executor } from './sql-store.mjs';
-export { createMemoryAuthStore, matchesWhere } from './store.mjs';
-export { TURNSTILE_VERIFY_ENDPOINT, verifyTurnstile } from './turnstile.mjs';
-export { verifyTurnstileMiddleware } from './turnstile-middleware.mjs';
+import{lunoraAuthAdapter as t,lunoraD1Adapter as o}from"./adapter.mjs";import{LunoraAuthAdminError as i,createAuthAdmin as u}from"./packem_shared/LunoraAuthAdminError-BiNYZM9j.mjs";import{AUTH_AUDIT_TABLE as l,appendAuthAuditEntry as m,createAuthAuditReader as s,ensureAuthAuditTable as d,readAuthAuditLog as h}from"./audit.mjs";import{authAuditHook as n,buildAuditEntry as f,eventForPath as x,withAuthAudit as E}from"./packem_shared/authAuditHook-Dx3sqf3G.mjs";import{createAuth as c,resolveAuthOptions as y}from"./packem_shared/createAuth-DS6PL8Mb.mjs";import{emailGateDatabaseHooks as S,withEmailGate as _}from"./packem_shared/emailGateDatabaseHooks-DzBD1Qoq.mjs";import{assertEmailAllowed as D,classifyEmail as H,emailGateMiddleware as P,loadEmailDomainLists as v}from"./email-guard.mjs";import{DEFAULT_AUTH_BASE_PATH as U,handleAuthRequest as b}from"./packem_shared/DEFAULT_AUTH_BASE_PATH-kIwlEt8i.mjs";import{LunoraAuthHeadersError as I,withAuthPlugins as R}from"./middleware.mjs";import{compileMigrationsSql as F,ensureMigrated as G}from"./packem_shared/compileMigrationsSql-ChiudSmt.mjs";import{default as k}from"./schema.mjs";import{sessionPresets as O,validateSessionPolicy as V}from"./packem_shared/sessionPresets-DpEFjXKV.mjs";import{createSqlAuthStore as Y,d1Executor as j}from"./sql-store.mjs";import{createMemoryAuthStore as C,matchesWhere as J}from"./store.mjs";import{TURNSTILE_VERIFY_ENDPOINT as Q,verifyTurnstile as X}from"./turnstile.mjs";import{verifyTurnstileMiddleware as $}from"./turnstile-middleware.mjs";export{l as AUTH_AUDIT_TABLE,U as DEFAULT_AUTH_BASE_PATH,i as LunoraAuthAdminError,I as LunoraAuthHeadersError,Q as TURNSTILE_VERIFY_ENDPOINT,m as appendAuthAuditEntry,D as assertEmailAllowed,n as authAuditHook,k as authTables,f as buildAuditEntry,H as classifyEmail,F as compileMigrationsSql,c as createAuth,u as createAuthAdmin,s as createAuthAuditReader,C as createMemoryAuthStore,Y as createSqlAuthStore,j as d1Executor,S as emailGateDatabaseHooks,P as emailGateMiddleware,d as ensureAuthAuditTable,G as ensureMigrated,x as eventForPath,b as handleAuthRequest,v as loadEmailDomainLists,t as lunoraAuthAdapter,o as lunoraD1Adapter,J as matchesWhere,h as readAuthAuditLog,y as resolveAuthOptions,O as sessionPresets,V as validateSessionPolicy,X as verifyTurnstile,$ as verifyTurnstileMiddleware,E as withAuthAudit,R as withAuthPlugins,_ as withEmailGate};

package/dist/middleware.d.mts

@@ -1,5 +1,5 @@
 import { LunoraError } from '@lunora/errors';
-import { L as LunoraAuth } from "./packem_shared/create-auth.d-COcIS_KU.mjs";
+import { L as LunoraAuth } from "./packem_shared/create-auth.d-De6IOirt.mjs";
 import 'better-auth';
 /**
  * Structural mirror of `@lunora/server`'s `MiddlewareNext` — the continuation

package/dist/middleware.d.ts

@@ -1,5 +1,5 @@
 import { LunoraError } from '@lunora/errors';
-import { L as LunoraAuth } from "./packem_shared/create-auth.d-COcIS_KU.js";
+import { L as LunoraAuth } from "./packem_shared/create-auth.d-De6IOirt.js";
 import 'better-auth';
 /**
  * Structural mirror of `@lunora/server`'s `MiddlewareNext` — the continuation

package/dist/middleware.mjs

@@ -1,56 +1 @@
-import { LunoraError } from '@lunora/errors';
-
-const callHasHeaders = (argument) => {
-  if (argument === void 0) {
-    return false;
-  }
-  if (typeof argument !== "object" || argument === null) {
-    return true;
-  }
-  const { headers } = argument;
-  return headers !== void 0 && headers !== null;
-};
-const guardAuthApi = (api) => {
-  const withoutHeaders = () => api;
-  return /* @__PURE__ */ new Proxy(api, {
-    // eslint-disable-next-line sonarjs/function-return-type -- a Proxy `get` trap is intrinsically polymorphic: it returns the synthetic `withoutHeaders`, the guarded endpoint wrapper, or any passthrough property value
-    get(target, property, receiver) {
-      if (property === "withoutHeaders" && !(property in target)) {
-        return withoutHeaders;
-      }
-      const value = Reflect.get(target, property, receiver);
-      if (typeof value !== "function" || typeof property !== "string") {
-        return value;
-      }
-      const method = property;
-      return (...arguments_) => {
-        if (!callHasHeaders(arguments_[0])) {
-          return Promise.reject(new LunoraAuthHeadersError(method));
-        }
-        return Reflect.apply(value, target, arguments_);
-      };
-    }
-  });
-};
-class LunoraAuthHeadersError extends LunoraError {
-  /** The `ctx.authApi.<method>` that was called without `headers`. */
-  method;
-  constructor(method) {
-    super(
-      "AUTH_HEADERS_MISSING",
-      `@lunora/auth: ctx.authApi.${method}(…) was called without \`headers\`. better-auth treats a header-less call as a trusted server-to-server invocation and skips session authorization entirely — an authorization bypass. Pass the inbound request headers: ctx.authApi.${method}({ body, headers: request.headers }). If you genuinely intend an unauthenticated server-to-server call, opt out explicitly via ctx.authApi.withoutHeaders().<method>(…), or disable the guard for the whole middleware with withAuthPlugins(auth, { enforceHeaders: false }).`,
-      { name: "LunoraAuthHeadersError" }
-    );
-    this.method = method;
-  }
-}
-const withAuthPlugins = (auth, options = {}) => {
-  const enforceHeaders = options.enforceHeaders ?? true;
-  const authApi = enforceHeaders ? guardAuthApi(auth.api) : auth.api;
-  return async ({ next }) => {
-    const extended = await next({ ctx: { authApi } });
-    return extended;
-  };
-};
-
-export { LunoraAuthHeadersError, withAuthPlugins };
+import{LunoraError as i}from"@lunora/errors";const h=e=>{if(e===void 0)return!1;if(typeof e!="object"||e===null)return!0;const{headers:t}=e;return t!=null},d=e=>{const t=()=>e;return new Proxy(e,{get(a,r,o){if(r==="withoutHeaders"&&!(r in a))return t;const s=Reflect.get(a,r,o);if(typeof s!="function"||typeof r!="string")return s;const u=r;return(...n)=>h(n[0])?Reflect.apply(s,a,n):Promise.reject(new c(u))}})};class c extends i{method;constructor(t){super("AUTH_HEADERS_MISSING",`@lunora/auth: ctx.authApi.${t}(…) was called without \`headers\`. better-auth treats a header-less call as a trusted server-to-server invocation and skips session authorization entirely — an authorization bypass. Pass the inbound request headers: ctx.authApi.${t}({ body, headers: request.headers }). If you genuinely intend an unauthenticated server-to-server call, opt out explicitly via ctx.authApi.withoutHeaders().<method>(…), or disable the guard for the whole middleware with withAuthPlugins(auth, { enforceHeaders: false }).`,{name:"LunoraAuthHeadersError"}),this.method=t}}const p=(e,t={})=>{const a=t.enforceHeaders??!0?d(e.api):e.api;return async({next:r})=>await r({ctx:{authApi:a}})};export{c as LunoraAuthHeadersError,p as withAuthPlugins};

package/dist/packem_shared/DEFAULT_AUTH_BASE_PATH-kIwlEt8i.mjs

@@ -0,0 +1 @@
+const s="/api/auth",r=async(h,t,n=s)=>{const a=new URL(t.url),e=n.endsWith("/")?n.slice(0,-1):n;if(!(a.pathname!==e&&!a.pathname.startsWith(`${e}/`)))return h.handler(t)};export{s as DEFAULT_AUTH_BASE_PATH,r as handleAuthRequest};

package/dist/packem_shared/LunoraAuthAdminError-BiNYZM9j.mjs

@@ -0,0 +1 @@
+import{LunoraError as S}from"@lunora/errors";import{getAuthTables as A}from"better-auth/db";class p extends S{constructor(u,w){super(w,u,{name:"LunoraAuthAdminError"})}}const O=50,M=500,z=3600,R=z*24,D=100*365*24*60*60,U=2880*60*1e3,N=new Set(["accessToken","backupCodes","idToken","password","publicKey","refreshToken","secret","token"]),k=s=>Math.min(Math.max(Math.trunc(s??O),1),M),T=s=>Math.max(0,Math.trunc(s??0)),c=s=>{const u={};for(const[w,m]of Object.entries(s))N.has(w)||(u[w]=m instanceof Date?m.getTime():m);return u},I=s=>Array.isArray(s)?s.join(","):s,b=s=>s.toLowerCase().replaceAll(/[^\da-z]+/g,"-").replaceAll(/^-|-$/g,""),x=new Set(["banExpires","banned","banReason","createdAt","email","emailVerified","id","name","role","updatedAt"]),E={displayUsername:"username",phoneNumber:"phone-number",phoneNumberVerified:"phone-number",username:"username"},_=s=>s==="boolean"?"boolean":s==="date"?"date":s==="number"?"number":"string",L=s=>{const u=[];for(const[w,m]of Object.entries(s))m.input===!1||m.references!==void 0||x.has(w)||u.push({name:w,plugin:E[w],required:m.required===!0,type:_(m.type),unique:m.unique===!0});return u},P=s=>{if(s instanceof p)return s;const u=s,w=u?.body?.code??u?.code??"AUTH_ADMIN_ERROR",m=u?.body?.message??u?.message??"auth admin operation failed";return new p(m,w)},F=(s,u={})=>{const w=s.$context,m=u.features??{},y=e=>{const a=new Set((e.plugins??[]).map(i=>i.id)),t=i=>a.has(i);return{accounts:m.accounts??!0,admin:m.admin??t("admin"),organization:m.organization??t("organization"),passkey:m.passkey??t("passkey"),twoFactor:m.twoFactor??t("two-factor")}},r=async e=>{try{return await e(await w)}catch(a){throw P(a)}},h=e=>c(e),g=async(e,a,t)=>{const i=t.where&&t.where.length>0?t.where:void 0,[n,o]=await Promise.all([e.adapter.findMany({limit:k(t.limit),model:a,offset:T(t.offset),sortBy:t.sortBy,where:i}),e.adapter.count({model:a,where:i})]);return{rows:n.map(d=>c(d)),total:o}};return{banUser:({expiresInSeconds:e,reason:a,userId:t})=>r(async i=>{let n=null;if(e!==void 0){if(!Number.isInteger(e)||e<=0)throw new p("expiresInSeconds must be a positive finite integer","INVALID_BAN_SECONDS");const d=Math.min(e,D);n=new Date(Date.now()+d*1e3)}const o=await i.internalAdapter.updateUser(t,{banExpires:n,banned:!0,banReason:a??"No reason"});return await i.internalAdapter.deleteUserSessions(t),h(o)}),cancelInvitation:({invitationId:e})=>r(async a=>{await a.adapter.delete({model:"invitation",where:[{field:"id",value:e}]})}),capabilities:()=>r(e=>Promise.resolve(y(e.options))),addMember:({organizationId:e,role:a,userId:t})=>r(async i=>{const n=await i.adapter.create({data:{createdAt:new Date,organizationId:e,role:a===void 0||a===""?"member":a,userId:t},model:"member"});return c(n)}),addTeamMember:({teamId:e,userId:a})=>r(async t=>{const i=await t.adapter.create({data:{createdAt:new Date,teamId:e,userId:a},model:"teamMember"});return c(i)}),config:()=>r(e=>{const a=e.options,t=y(a),i=new Set((a.plugins??[]).map(l=>l.id)),n=A(a),o=a.session??{},d=a.rateLimit??{};return Promise.resolve({capabilities:t,emailAndPassword:a.emailAndPassword?.enabled??!1,organization:{enabled:t.organization,roles:!!n.organizationRole,teams:!!n.team},plugins:[...i].toSorted((l,f)=>l.localeCompare(f)),rateLimit:{enabled:d.enabled??!1,max:d.max,window:d.window},session:{cookieCache:o.cookieCache?.enabled,expiresIn:o.expiresIn,freshAge:o.freshAge,updateAge:o.updateAge},socialProviders:Object.keys(a.socialProviders??{}).toSorted((l,f)=>l.localeCompare(f)),userFields:L(n.user?.fields??{})})}),createOrganization:({logo:e,metadata:a,name:t,ownerId:i,slug:n})=>r(async o=>{const d=b(n!==void 0&&n!==""?n:t);if(d==="")throw new p("could not derive a slug from the organization name","ORG_SLUG_INVALID");if(await o.adapter.findOne({model:"organization",where:[{field:"slug",value:d}]}))throw new p("an organization with this slug already exists","ORG_SLUG_TAKEN");const l=await o.adapter.create({data:{createdAt:new Date,logo:e===void 0||e===""?void 0:e,metadata:a===void 0?void 0:JSON.stringify(a),name:t,slug:d},model:"organization"});return i!==void 0&&i!==""&&await o.adapter.create({data:{createdAt:new Date,organizationId:l.id,role:"owner",userId:i},model:"member"}),c(l)}),createOrgRole:({organizationId:e,permission:a,role:t})=>r(async i=>{const n=await i.adapter.create({data:{createdAt:new Date,organizationId:e,permission:JSON.stringify(a),role:t},model:"organizationRole"});return c(n)}),createTeam:({name:e,organizationId:a})=>r(async t=>{const i=await t.adapter.create({data:{createdAt:new Date,name:e,organizationId:a},model:"team"});return c(i)}),deleteOrganization:({organizationId:e})=>r(async a=>{const t=A(a.options);if(await a.adapter.deleteMany({model:"member",where:[{field:"organizationId",value:e}]}),await a.adapter.deleteMany({model:"invitation",where:[{field:"organizationId",value:e}]}),t.team){const i=await a.adapter.findMany({model:"team",where:[{field:"organizationId",value:e}]});for(const n of i)await a.adapter.deleteMany({model:"teamMember",where:[{field:"teamId",value:n.id}]});await a.adapter.deleteMany({model:"team",where:[{field:"organizationId",value:e}]})}t.organizationRole&&await a.adapter.deleteMany({model:"organizationRole",where:[{field:"organizationId",value:e}]}),await a.adapter.delete({model:"organization",where:[{field:"id",value:e}]})}),deleteOrgRole:({roleId:e})=>r(async a=>{await a.adapter.delete({model:"organizationRole",where:[{field:"id",value:e}]})}),inviteMember:({email:e,inviterId:a,organizationId:t,role:i})=>r(async n=>{let o=a;if(o===void 0||o===""){const l=await n.adapter.findMany({model:"member",where:[{field:"organizationId",value:t}]});o=(l.find(f=>typeof f.role=="string"&&f.role.includes("owner"))??l[0])?.userId}if(o===void 0||o==="")throw new p("provide an inviter — the organization has no members to attribute the invitation to","INVITER_REQUIRED");const d=await n.adapter.create({data:{createdAt:new Date,email:e.toLowerCase(),expiresAt:new Date(Date.now()+U),inviterId:o,organizationId:t,role:i===void 0||i===""?"member":i,status:"pending"},model:"invitation"});return c(d)}),listOrgRoles:({limit:e,offset:a,organizationId:t})=>r(i=>g(i,"organizationRole",{limit:e,offset:a,sortBy:{direction:"desc",field:"createdAt"},where:[{field:"organizationId",value:t}]})),listTeamMembers:({limit:e,offset:a,teamId:t})=>r(i=>g(i,"teamMember",{limit:e,offset:a,where:[{field:"teamId",value:t}]})),listTeams:({limit:e,offset:a,organizationId:t})=>r(i=>g(i,"team",{limit:e,offset:a,sortBy:{direction:"desc",field:"createdAt"},where:[{field:"organizationId",value:t}]})),removeTeam:({teamId:e})=>r(async a=>{await a.adapter.deleteMany({model:"teamMember",where:[{field:"teamId",value:e}]}),await a.adapter.delete({model:"team",where:[{field:"id",value:e}]})}),removeTeamMember:({teamMemberId:e})=>r(async a=>{await a.adapter.delete({model:"teamMember",where:[{field:"id",value:e}]})}),updateMemberRole:({memberId:e,role:a})=>r(async t=>{const i=await t.adapter.update({model:"member",update:{role:I(a)},where:[{field:"id",value:e}]});return c(i??{id:e,role:I(a)})}),updateOrganization:({logo:e,metadata:a,name:t,organizationId:i,slug:n})=>r(async o=>{const d={};if(t!==void 0&&(d.name=t),n!==void 0&&n!==""&&(d.slug=b(n)),e!==void 0&&(d.logo=e===""?void 0:e),a!==void 0&&(d.metadata=JSON.stringify(a)),Object.keys(d).length===0)return c({id:i});const l=await o.adapter.update({model:"organization",update:d,where:[{field:"id",value:i}]});return c(l??{id:i})}),updateOrgRole:({permission:e,roleId:a})=>r(async t=>{const i=await t.adapter.update({model:"organizationRole",update:{permission:JSON.stringify(e),updatedAt:new Date},where:[{field:"id",value:a}]});return c(i??{id:a,permission:JSON.stringify(e)})}),updateTeam:({name:e,teamId:a})=>r(async t=>{const i=await t.adapter.update({model:"team",update:{name:e,updatedAt:new Date},where:[{field:"id",value:a}]});return c(i??{id:a,name:e})}),createUser:({data:e,email:a,name:t,password:i,role:n})=>r(async o=>{const d=a.toLowerCase();if(await o.internalAdapter.findUserByEmail(d))throw new p("a user with this email already exists","USER_ALREADY_EXISTS");const l=await o.internalAdapter.createUser({email:d,name:t,role:n===void 0?void 0:I(n),...e});if(i!==void 0&&i!==""){const f=await o.password.hash(i);await o.internalAdapter.linkAccount({accountId:l.id,password:f,providerId:"credential",userId:l.id})}return h(l)}),deletePasskey:({passkeyId:e})=>r(async a=>{await a.adapter.delete({model:"passkey",where:[{field:"id",value:e}]})}),disableTwoFactor:({userId:e})=>r(async a=>{await a.adapter.deleteMany({model:"twoFactor",where:[{field:"userId",value:e}]}),await a.internalAdapter.updateUser(e,{twoFactorEnabled:!1})}),impersonateUser:({userId:e})=>r(async a=>{const t=await a.internalAdapter.findUserById(e);if(!t)throw new p("user not found","USER_NOT_FOUND");const i=u.impersonationSeconds;let n=z;if(i!==void 0){if(!Number.isInteger(i)||!Number.isFinite(i)||i<=0)throw new p("impersonationSeconds must be a positive finite integer","INVALID_IMPERSONATION_SECONDS");n=Math.min(i,R)}const o=new Date(Date.now()+n*1e3),d=await a.internalAdapter.createSession(e,!0,{expiresAt:o,impersonatedBy:u.impersonatedBy??e},!0);return{expiresAt:d.expiresAt instanceof Date?d.expiresAt.getTime():o.getTime(),token:d.token,user:h(t)}}),listAccounts:({userId:e})=>r(async a=>(await a.adapter.findMany({model:"account",where:[{field:"userId",value:e}]})).map(t=>c(t))),listInvitations:({limit:e,offset:a,organizationId:t})=>r(i=>g(i,"invitation",{limit:e,offset:a,where:[{field:"organizationId",value:t}]})),listMembers:({limit:e,offset:a,organizationId:t})=>r(i=>g(i,"member",{limit:e,offset:a,sortBy:{direction:"desc",field:"createdAt"},where:[{field:"organizationId",value:t}]})),listOrganizations:({limit:e,offset:a})=>r(t=>g(t,"organization",{limit:e,offset:a,sortBy:{direction:"desc",field:"createdAt"}})),listPasskeys:({userId:e})=>r(async a=>(await a.adapter.findMany({model:"passkey",where:[{field:"userId",value:e}]})).map(t=>c(t))),listSessions:({limit:e,offset:a,userId:t})=>r(i=>g(i,"session",{limit:e,offset:a,sortBy:{direction:"desc",field:"createdAt"},where:t===void 0||t===""?void 0:[{field:"userId",value:t}]})),listUsers:({filterField:e,filterValue:a,limit:t,offset:i,search:n,searchField:o,sortBy:d,sortDirection:l})=>r(f=>{const v=[];return n!==void 0&&n!==""&&v.push({field:o??"email",operator:"contains",value:n}),a!==void 0&&v.push({field:e??"email",operator:"eq",value:a}),g(f,"user",{limit:t,offset:i,sortBy:{direction:l??"desc",field:d??"createdAt"},where:v})}),removeMember:({memberId:e})=>r(async a=>{await a.adapter.delete({model:"member",where:[{field:"id",value:e}]})}),removeUser:({userId:e})=>r(async a=>{await a.internalAdapter.deleteUserSessions(e),await a.internalAdapter.deleteUser(e)}),revokeUserSession:({sessionId:e})=>r(async a=>{const t=await a.adapter.findOne({model:"session",where:[{field:"id",value:e}]});t?.token&&await a.internalAdapter.deleteSession(t.token)}),revokeUserSessions:({userId:e})=>r(async a=>{await a.internalAdapter.deleteUserSessions(e)}),setRole:({role:e,userId:a})=>r(async t=>{const i=await t.internalAdapter.updateUser(a,{role:I(e)});return h(i)}),setUserPassword:({newPassword:e,userId:a})=>r(async t=>{const i=t.password.config.minPasswordLength,n=t.password.config.maxPasswordLength;if(e.length<i)throw new p(`password must be at least ${i.toString()} characters`,"PASSWORD_TOO_SHORT");if(e.length>n)throw new p(`password must be at most ${n.toString()} characters`,"PASSWORD_TOO_LONG");const o=await t.password.hash(e);await t.internalAdapter.updatePassword(a,o)}),unbanUser:({userId:e})=>r(async a=>{const t=await a.internalAdapter.updateUser(e,{banExpires:null,banned:!1,banReason:null});return h(t)}),unlinkAccount:({accountId:e,userId:a})=>r(async t=>{await t.adapter.delete({model:"account",where:[{field:"id",value:e},{connector:"AND",field:"userId",value:a}]})}),updateUser:({data:e,userId:a})=>r(async t=>{const i=await t.internalAdapter.updateUser(a,e);return h(i)})}};export{p as LunoraAuthAdminError,F as createAuthAdmin};

package/dist/packem_shared/authAuditHook-Dx3sqf3G.mjs

@@ -0,0 +1 @@
+import{createAuthMiddleware as a}from"better-auth/api";import{appendAuthAuditEntry as u}from"../audit.mjs";const c=r=>{const t=r.toLowerCase(),e=n=>t===n||t.endsWith(n);if(e("/sign-up/email")||e("/sign-up"))return"sign-up";if(t.includes("/sign-in/"))return"sign-in";if(e("/sign-out"))return"sign-out";if(e("/change-password")||e("/set-password"))return"password-change";if(e("/reset-password")||e("/request-password-reset")||e("/forget-password"))return"password-reset";if(e("/verify-email"))return"email-verification";if(t.includes("/two-factor/enable")||t.includes("/totp/enable"))return"mfa-enable";if(t.includes("/two-factor/disable")||t.includes("/totp/disable"))return"mfa-disable";if(e("/refresh-token")||e("/token"))return"token-refresh";if(e("/revoke-session")||e("/revoke-sessions")||e("/revoke-other-sessions"))return"session-revoke";if(e("/link-social"))return"account-link";if(e("/unlink-account"))return"account-unlink"},s=(r,t)=>r.headers?.get(t)??r.request?.headers.get(t)??void 0,d=r=>{const t=s(r,"x-forwarded-for");return s(r,"cf-connecting-ip")??(t===void 0?void 0:t.split(",")[0]?.trim())??s(r,"x-real-ip")},f=r=>{const t=r.context?.newSession??r.context?.session,e=t?.user?.id??t?.session?.userId,n=t?.user?.email;return{...e===void 0?{}:{actorId:e},...n===void 0?{}:{actorEmail:n}}},l=r=>{const t=r.context?.returned;if(t instanceof Error)return"failure";if(typeof t=="object"&&t!==null&&"status"in t){const e=Number(t.status);if(Number.isFinite(e)&&e>=400)return"failure"}return"success"},p=(r,t=Date.now())=>{const e=r.path===void 0?void 0:c(r.path);if(e===void 0)return;const n=d(r),o=s(r,"user-agent");return{...f(r),event:e,outcome:l(r),ts:t,...n===void 0?{}:{ip:n},...o===void 0?{}:{userAgent:o},detail:{path:r.path}}},h=r=>a(async t=>{try{const e=p(t);if(e!==void 0){const n=await u(r.executor,e,{redactDetail:r.redactDetail,retention:r.retention});r.onRecord!==void 0&&await r.onRecord(n)}}catch(e){console.error("@lunora/auth: audit hook failed to record event",e)}return{}}),k=(r,t)=>{const e=h(t),n=r.hooks?.after,o=n?async i=>(await n(i),e(i)):e;return{...r,hooks:{...r.hooks,after:o}}};export{h as authAuditHook,p as buildAuditEntry,c as eventForPath,k as withAuthAudit};

package/dist/packem_shared/compileMigrationsSql-ChiudSmt.mjs

@@ -0,0 +1 @@
+import{getMigrations as e}from"better-auth/db/migration";import{resolveAuthOptions as s}from"./createAuth-DS6PL8Mb.mjs";const o=new WeakMap,g=async i=>{const{options:t}=i,n=o.get(t);if(n){await n;return}const r=(async()=>{const{runMigrations:a}=await e(t);await a()})();o.set(t,r);try{await r}catch(a){throw o.delete(t),a}},w=async i=>{const{compileMigrations:t}=await e(s(i));return t()};export{w as compileMigrationsSql,g as ensureMigrated};

package/dist/packem_shared/{create-auth.d-COcIS_KU.d.mts → create-auth.d-De6IOirt.d.mts}

@@ -66,7 +66,7 @@ type LunoraAuth = ReturnType<typeof betterAuth>;
  * Rate limiting is ON by default for `/api/auth/*`.
  *
  * better-auth's own default is `rateLimit.enabled ?? isProduction`, and its
- * `isProduction` is `"development" === "production"` resolved at
+ * `isProduction` is `"production" === "production"` resolved at
  * module-load time. On Cloudflare Workers that check is unreliable: the
  * runtime has no Node `process.env` (absent entirely without
  * `nodejs_compat`, and even with it `NODE_ENV` is rarely `"production"` at

package/dist/packem_shared/{create-auth.d-COcIS_KU.d.ts → create-auth.d-De6IOirt.d.ts}

@@ -66,7 +66,7 @@ type LunoraAuth = ReturnType<typeof betterAuth>;
  * Rate limiting is ON by default for `/api/auth/*`.
  *
  * better-auth's own default is `rateLimit.enabled ?? isProduction`, and its
- * `isProduction` is `"development" === "production"` resolved at
+ * `isProduction` is `"production" === "production"` resolved at
  * module-load time. On Cloudflare Workers that check is unreliable: the
  * runtime has no Node `process.env` (absent entirely without
  * `nodejs_compat`, and even with it `NODE_ENV` is rarely `"production"` at

package/dist/packem_shared/createAuth-DS6PL8Mb.mjs

@@ -0,0 +1 @@
+import{LunoraError as a}from"@lunora/errors";import{betterAuth as n}from"better-auth";import{validateSessionPolicy as c}from"./sessionPresets-DpEFjXKV.mjs";const i=32,l=e=>{const t=typeof e=="string"?e.trim().length:0;return t>0&&t<i},s=e=>typeof e=="string"?e.toLowerCase().startsWith("http://"):e&&typeof e=="object"?e.protocol==="http"?!0:e.protocol==="https"?!1:typeof e.fallback=="string"&&e.fallback.toLowerCase().startsWith("http://"):!1,u=e=>{if(l(e.secret)){const r=`@lunora/auth: AUTH_SECRET is only ${String(e.secret?.trim().length)} characters. Use at least ${String(i)} for a brute-force-resistant secret — generate one with \`openssl rand -hex 32\`.`;if(!s(e.baseURL))throw new a("INTERNAL",r);console.warn(r)}const t=e.advanced??{};return{...e,advanced:{...t,defaultCookieAttributes:t.defaultCookieAttributes??{httpOnly:!0,path:"/",sameSite:"lax"},...t.useSecureCookies===void 0?{useSecureCookies:!s(e.baseURL)}:{}}}},h=e=>{const t=u(e),r=t.rateLimit?.enabled===void 0,o=t.rateLimit?.storage===void 0&&t.rateLimit?.enabled!==!1;return{...t,...r||o?{rateLimit:{...t.rateLimit,...r?{enabled:!0}:{},...o?{storage:"database"}:{}}}:{},...t.session?.cookieCache===void 0?{session:{...t.session,cookieCache:{enabled:!0,maxAge:60}}}:{}}},m=e=>{if(!e.secret||e.secret.trim()==="")throw new a("INTERNAL",'@lunora/auth: `secret` is required. Set AUTH_SECRET locally in .dev.vars (`lunora env set AUTH_SECRET "$(openssl rand -hex 32)"`), and in production with `wrangler secret put AUTH_SECRET`.');return e.session&&c(e.session),n(h(e))};export{m as createAuth,h as resolveAuthOptions};

package/dist/packem_shared/emailGateDatabaseHooks-DzBD1Qoq.mjs

@@ -0,0 +1 @@
+import{LunoraError as i}from"@lunora/errors";import{APIError as u}from"better-auth/api";import{assertEmailAllowed as E}from"../email-guard.mjs";const m=a=>{switch(a){case 400:return"BAD_REQUEST";case 422:return"UNPROCESSABLE_ENTITY";case 429:return"TOO_MANY_REQUESTS";default:return"INTERNAL_SERVER_ERROR"}},n=a=>async(s,t)=>{const r=typeof s.email=="string"?s.email:void 0;if(r===void 0||r==="")return;let o;try{o=await E(r,a)}catch(e){throw e instanceof i?new u(m(e.status),{code:e.code,message:e.message}):e}a.onClassify?.(o,s,t)},b=(a={})=>({user:{create:{before:n(a)}}}),R=(a,s={})=>{const t=n(s),r=a.databaseHooks?.user?.create?.before,o=r?async(e,c)=>(await t(e,c),r(e,c)):t;return{...a,databaseHooks:{...a.databaseHooks,user:{...a.databaseHooks?.user,create:{...a.databaseHooks?.user?.create,before:o}}}}};export{b as emailGateDatabaseHooks,R as withEmailGate};

package/dist/packem_shared/sessionPresets-DpEFjXKV.mjs

@@ -0,0 +1 @@
+const r=s=>{const o=["expiresIn","updateAge","freshAge"];for(const n of o){const e=s[n];if(e!==void 0&&(typeof e!="number"||!Number.isFinite(e)||e<0))throw new TypeError(`@lunora/auth: \`session.${n}\` must be a non-negative, finite number of seconds`)}return s},i={longLived:{cookieCache:{enabled:!0,maxAge:60},expiresIn:2592e3,freshAge:86400,updateAge:86400},rolling:{cookieCache:{enabled:!0,maxAge:60},expiresIn:604800,freshAge:86400,updateAge:86400},strict:{cookieCache:{enabled:!1},expiresIn:3600,freshAge:300,updateAge:900}};export{i as sessionPresets,r as validateSessionPolicy};

package/dist/plugins-client.mjs

@@ -1,2 +1 @@
-export { passkeyClient } from '@better-auth/passkey/client';
-export { adminClient, anonymousClient, customSessionClient, deviceAuthorizationClient, emailOTPClient, genericOAuthClient, inferAdditionalFields, inferOrgAdditionalFields, jwtClient, lastLoginMethodClient, magicLinkClient, multiSessionClient, oidcClient, oneTimeTokenClient, organizationClient, phoneNumberClient, siweClient, twoFactorClient, usernameClient } from 'better-auth/client/plugins';
+import{passkeyClient as n}from"@better-auth/passkey/client";import{adminClient as l,anonymousClient as o,customSessionClient as C,deviceAuthorizationClient as a,emailOTPClient as r,genericOAuthClient as s,inferAdditionalFields as m,inferOrgAdditionalFields as d,jwtClient as u,lastLoginMethodClient as c,magicLinkClient as g,multiSessionClient as f,oidcClient as h,oneTimeTokenClient as p,organizationClient as A,phoneNumberClient as k,siweClient as w,twoFactorClient as F,usernameClient as O}from"better-auth/client/plugins";export{l as adminClient,o as anonymousClient,C as customSessionClient,a as deviceAuthorizationClient,r as emailOTPClient,s as genericOAuthClient,m as inferAdditionalFields,d as inferOrgAdditionalFields,u as jwtClient,c as lastLoginMethodClient,g as magicLinkClient,f as multiSessionClient,h as oidcClient,p as oneTimeTokenClient,A as organizationClient,n as passkeyClient,k as phoneNumberClient,w as siweClient,F as twoFactorClient,O as usernameClient};

package/dist/plugins.mjs

@@ -1,22 +1 @@
-export { passkey } from '@better-auth/passkey';
-export { captcha, mcp, withMcpAuth } from 'better-auth/plugins';
-export { createAccessControl } from 'better-auth/plugins/access';
-export { admin } from 'better-auth/plugins/admin';
-export { anonymous } from 'better-auth/plugins/anonymous';
-export { bearer } from 'better-auth/plugins/bearer';
-export { customSession } from 'better-auth/plugins/custom-session';
-export { deviceAuthorization } from 'better-auth/plugins/device-authorization';
-export { emailOTP } from 'better-auth/plugins/email-otp';
-export { genericOAuth } from 'better-auth/plugins/generic-oauth';
-export { haveIBeenPwned } from 'better-auth/plugins/haveibeenpwned';
-export { jwt } from 'better-auth/plugins/jwt';
-export { magicLink } from 'better-auth/plugins/magic-link';
-export { multiSession } from 'better-auth/plugins/multi-session';
-export { oAuthProxy } from 'better-auth/plugins/oauth-proxy';
-export { oidcProvider } from 'better-auth/plugins/oidc-provider';
-export { oneTimeToken } from 'better-auth/plugins/one-time-token';
-export { organization } from 'better-auth/plugins/organization';
-export { phoneNumber } from 'better-auth/plugins/phone-number';
-export { siwe } from 'better-auth/plugins/siwe';
-export { twoFactor } from 'better-auth/plugins/two-factor';
-export { username } from 'better-auth/plugins/username';
+import{passkey as e}from"@better-auth/passkey";import{captcha as m,mcp as p,withMcpAuth as x}from"better-auth/plugins";import{createAccessControl as i}from"better-auth/plugins/access";import{admin as a}from"better-auth/plugins/admin";import{anonymous as s}from"better-auth/plugins/anonymous";import{bearer as h}from"better-auth/plugins/bearer";import{customSession as w}from"better-auth/plugins/custom-session";import{deviceAuthorization as P}from"better-auth/plugins/device-authorization";import{emailOTP as k}from"better-auth/plugins/email-otp";import{genericOAuth as v}from"better-auth/plugins/generic-oauth";import{haveIBeenPwned as T}from"better-auth/plugins/haveibeenpwned";import{jwt as z}from"better-auth/plugins/jwt";import{magicLink as S}from"better-auth/plugins/magic-link";import{multiSession as B}from"better-auth/plugins/multi-session";import{oAuthProxy as F}from"better-auth/plugins/oauth-proxy";import{oidcProvider as L}from"better-auth/plugins/oidc-provider";import{oneTimeToken as N}from"better-auth/plugins/one-time-token";import{organization as D}from"better-auth/plugins/organization";import{phoneNumber as G}from"better-auth/plugins/phone-number";import{siwe as J}from"better-auth/plugins/siwe";import{twoFactor as Q}from"better-auth/plugins/two-factor";import{username as U}from"better-auth/plugins/username";export{a as admin,s as anonymous,h as bearer,m as captcha,i as createAccessControl,w as customSession,P as deviceAuthorization,k as emailOTP,v as genericOAuth,T as haveIBeenPwned,z as jwt,S as magicLink,p as mcp,B as multiSession,F as oAuthProxy,L as oidcProvider,N as oneTimeToken,D as organization,e as passkey,G as phoneNumber,J as siwe,Q as twoFactor,U as username,x as withMcpAuth};

package/dist/schema.d.mts

@@ -1,5 +1,5 @@
 import { TableDefinition } from '@lunora/server';
-import { a as LunoraAuthOptions } from "./packem_shared/create-auth.d-COcIS_KU.mjs";
+import { a as LunoraAuthOptions } from "./packem_shared/create-auth.d-De6IOirt.mjs";
 import 'better-auth';
 /**
  * Derive Lunora table definitions from a better-auth config — the bridge that

package/dist/schema.d.ts

@@ -1,5 +1,5 @@
 import { TableDefinition } from '@lunora/server';
-import { a as LunoraAuthOptions } from "./packem_shared/create-auth.d-COcIS_KU.js";
+import { a as LunoraAuthOptions } from "./packem_shared/create-auth.d-De6IOirt.js";
 import 'better-auth';
 /**
  * Derive Lunora table definitions from a better-auth config — the bridge that

package/dist/schema.mjs

@@ -1,62 +1 @@
-import { defineTable } from '@lunora/server';
-import { v } from '@lunora/values';
-import { getAuthTables } from 'better-auth/db';
-
-const baseValidator = (attribute) => {
-  if (attribute.references) {
-    return v.id(attribute.references.model);
-  }
-  const { type } = attribute;
-  if (Array.isArray(type)) {
-    return v.string();
-  }
-  switch (type) {
-    case "boolean": {
-      return v.boolean();
-    }
-    case "date": {
-      return v.date();
-    }
-    case "number": {
-      return v.number();
-    }
-    case "number[]": {
-      return v.array(v.number());
-    }
-    case "string": {
-      return v.string();
-    }
-    case "string[]": {
-      return v.array(v.string());
-    }
-    // "json" and anything unrecognised: keep the row shape permissive rather
-    // than fail schema generation on a plugin's exotic column type.
-    default: {
-      return v.any();
-    }
-  }
-};
-const fieldValidator = (attribute) => {
-  let validator = baseValidator(attribute);
-  if (attribute.required === false) {
-    validator = validator.nullable();
-  }
-  if (attribute.unique === true) {
-    validator = validator.unique();
-  }
-  return validator;
-};
-const authTables = (options) => {
-  const tables = getAuthTables(options);
-  const schema = {};
-  for (const table of Object.values(tables)) {
-    const shape = {};
-    for (const [fieldKey, attribute] of Object.entries(table.fields)) {
-      shape[attribute.fieldName ?? fieldKey] = fieldValidator(attribute);
-    }
-    schema[table.modelName] = defineTable(shape).externallyManaged();
-  }
-  return schema;
-};
-
-export { authTables as default };
+import{defineTable as i}from"@lunora/server";import{v as e}from"@lunora/values";import{getAuthTables as c}from"better-auth/db";const f=n=>{if(n.references)return e.id(n.references.model);const{type:r}=n;if(Array.isArray(r))return e.string();switch(r){case"boolean":return e.boolean();case"date":return e.date();case"number":return e.number();case"number[]":return e.array(e.number());case"string":return e.string();case"string[]":return e.array(e.string());default:return e.any()}},l=n=>{let r=f(n);return n.required===!1&&(r=r.nullable()),n.unique===!0&&(r=r.unique()),r},g=n=>{const r=c(n),t={};for(const a of Object.values(r)){const s={};for(const[o,u]of Object.entries(a.fields))s[u.fieldName??o]=l(u);t[a.modelName]=i(s).externallyManaged()}return t};export{g as default};